This article covers the program Windows LIVE Photo Gallery and analysis
of data file typically titled pictures.pd5 file and how to extract the content
for review.

Windows Live Photo Gallery (WLPG) is a multimedia management tool developed
by Microsoft and comes installed as part of the Microsoft Windows Vista
operating system (optional download). It is accessible from the Start menu
under 'Programs' when installed.

WLPG allows you to batch preview photo and video content as a series of
thumbnails serving as an electronic photo album.
A user can add additional information or 'tags' to each entry including
comments, ratings and other descriptive information.

Furthermore Windows Live Photo Gallery has built in facial recognition.
A user can assign text and descriptive information to faces within each photograph.

The above picture shows WLPG running and previewing a picture file, built in facial recognition
has identifed a face when the mouse was hovered over the persons face.
New files are added from the menu option 'Add Folder to Gallery'.
Files can be previewed by tag, date or by rating, views can be filtered to show only
picture, video or both.

The information generated when a user has previewed files using WLPG is written
to disk in a single file, this is typically titled 'pictures.pd5', one file exists for each
profile on the computer in the following location:

Information is also written to disk in the Vista Operating system thumbcache file;
this is where the picture information is stored. When a user previews using WLPG
the generated thumbnail pictures are stored in the thumbcache files relating to that
particular profile. Each user profile on the computer has its own thumbcache repository.
It is important to note that the Vista operating system thumbcache is not only used
by WLPG, it also stores thumbnail pictures in the cache when previewing using Windows
explorer.

VOLUME\Users\PROFILE\AppData\Local\Microsoft\Windows\Explorer

The WLPG data file can be readily examined using the tool WPG Live Viewer a forensic software
tool which is part of the Simple Carver Suite and is capable of reading the 'pictures.pd5' file.